MuckRock News 

DEPT MR 75651 

411A Highland Ave 

Somerville, MA 02144-2516 

75651-32337139@requests.muckrock.com 


Fairfax County Police Department 
FOIA Office 

12000 Government Center Parkway 
Fairfax, VA 22035 


June 24, 2019 




To Whom It May Concern: 

Pursuant to the Virginia Freedom of Information Act, I hereby request the following records: 

Records mentioning, describing or generated as a result of the 8 May 2015 Roll Call Release IA-0181-15 
{which was designed to be shared widely with law enforcement) from the Department of Homeland 
Security's Office of intelligence and Analysis (l&A) in conjunction with the Federal Bureau of Investigation, 
titled "Criminal Hackers Target Police to Protest Perceived Injustices," as well as records otherwise 
responding or reacting to the issues raised in it. 

I am a member of the news media and request classification as such. I have previously written about the 
government and its activities, with some reaching over 100,000 readers in outlets such as Gizmodo, 
MuckRock, Motherboard, Property of the People, Unicom Riot, and The Outline, among others. As such, as 
I have a reasonable expectation of publication and my editorial and writing skills are well established. In 
addition, I discuss and comment on the files online and make them available through non-profits such as 
the library Internet Archive and the journalist non-profit MuckRock, disseminating them to a large 
audience. While my research is not limited to this, a great deal of it, including this, focuses on the activities 
and attitudes of the government itself. 

As my primary purpose is to inform about government activities by reporting on it and making the raw data 
available, I request that fees be waived. 

The requested documents will be made available to the general public, and this request is not being made 
for commercial purposes. 

In the event that there are fees, I would be grateful if you would inform me of the total charges in advance 
of fulfilling my request. I would prefer the request filled electronically, by e-mail attachment if available or 
CD-ROM if not. 

Thank you in advance for your anticipated cooperation in this matter. I look forward to receiving your 
response to this request within 5 business days, as the statute requires. 

Please note that i am a citizen of Virginia, and am using MuckRock's services to help manage and track my 
request. 
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MuckRock News 

DEPT MR 75651 

411A Highland Ave 

Somerville, MA 02144-2516 

75651-32337139@requests.muckrock.com 


Sincerely, 
Tom Nash 


Filed via MuckRock.com 

E-mail (Preferred): 75651-32337139@requests.muckrock.com 

For mailed responses, please address (see note): 

MuckRock News 
DEPT MR 75651 
411A Highland Ave 
Somerville, MA 02144-2516 

PLEASE NOTE: This request is not filed by a MuckRock staff member, but is being sent through MuckRock 
by the above in order to better track, share, and manage public records requests. Also note that improperly 
addressed (i.e., with the requester's name rather than "MuckRock News" and the department number) 
requests might be returned as undeliverable. 
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UNC LASSI F IFDf/FOR OFFICIAL USE ONLY 


ROLL CALL RELEASE 

INTELLIGENCE FOR POLICE FIRE, EM5, AND SECURITY PERSONNEL 


8 May 2015 

(U//FOUO) Criminal Hackers Target Police to Protest Perceived Injustices 

(U//FOUG) Disruptive cyber attacks by criminal hackers—primarily 
distnbuted-denial-of-service (DDoS) attacks—targeting local law enforcement 
websites have increased since August 2014. We judge that this is almost 
certainly a result of the heightened coverage surrounding the alleged use of 
excessive force by law enforcement and an increased focus on incidents of 
perceived police brutality* The primary impact from the majority of these 
attacks has been the temporary disruption of the targeted public-facing websites, 

» (U//FOUO) In 2014, the Multi-State Information Sharing and Analysis 
Center (MS-ISAC) observed 53 separate incidents of criminal hackers 
conducting cyber operations against state and local entities in response to 
incidents of alleged use of excessive force by law enforcement. The majority of these incidents were low to 
moderate in effect, most frequently resulting in temporary disruption to targeted websites* 

» (U//FOUO) On the morning of 30 December 2014, unknown criminal hackers disabled a Midwestern police 
department's public website using a DDoS attack. A post later that morning on a US social-networking site 
containing the hash tag ‘WBIackLtves Matter * announced that the targeted website was down. The disabling 
of this website was the third successful attack to disable a law enforcement website in the state within a week— 
the attacks were limited to the temporary disablement of targeted websites, according to DHS field reporting. 

» (U//FOUO) A criminal hacker using the moniker (at)DigitaShadow claimed responsibility on a US social-media site 
for disrupting access to a Northwestern city police department's website in early December 2014. The DDoS 
attack, which lasted approximately I Q minutes, prevented the department's in-car terminals from transmitting or 
receiving traffic, including 91 I dispatch requests, according to FBI reporting* 

(U//FOUO) MS-ISAC Distributed-Denfal-of-Servke Mitigation Recommendations 

(U) Proactive protections include: 

» (U) Establish connections with multiple Internet service providers (ISPs) for redundancy, 

» (U) Ensure service-level agreements with ISPs contain provisions for DoS prevention (such as IP address rotation), 

» (U) Conduct rate-limiting of traffic at the network perimeter, and 

» (U) Create backup, remote-site network infrastructure using multiple addressing schemes. 

(U) Reactive protections include: 

» (U) Execute ISP address rotation. 

» (U) Block source IP addresses generating DoS traffic at enterprise boundary or within ISP infrastructure, and 

» (U) Acquire increased bandwidth capability from the ISP. 

(U//FOUO) See MS-1SACs “Guide to DDoS Attacks'* for additional information: 

hitp:// m sisac. ci se c u rity. o rg/reso u rc e s/re po rts/ do c u m en ts/G uid eto D D o SAtta c ks_000. pdf 


UNCLASSIFIED 



(U) Figure I. Criminal Hackers 
Targeting Police 



(U) Reporting Computer Security Incidents 


(U) To report a computer security incident, either contact US-CERT at 888-282-0S70, or go to https://forrm,u5-cert.govf report/ and 
complete the US-CERT Incident Reporting System form* The US-CERT Incident Reporting System provides a secure, web-enabled means of 
reporting computer security incidents to US-CERT. An incident is defined as a violation or imminent threat of violation of computer security policies, 
acceptable use policies, or standard computer security practices In general, types of activity commonly recognized as violating typical security policies 
include attempts (either failed or successful) to gain unauthorized access to a system or its data, including personally identifiable information; unwanted 
disruption or denial of service; the unauthorized use of a system for processing or storing data: and changes to system hardware, firmware, or software 
without the owner's knowledge, instruction, or consent 


IA-0I8M5 


(U) Prepared by die Office of jnlellgence and Arioijrais O&A) Coordinated with the F&l TTw product ts intended to provide cybersecurtty 4W0WM8 to federal slofe, local cmd private seder first responders m mailers find 
can affect personnel ood network security of their respective orionizaponi 

(U) Wwfijjif; 77us document is UNCLASSiFSEDflFQR OFFICIAL USE ONLV (UtlFQUGj it contains information that may be exempt from pubk release under the Freedom of information Act (5 L/.S.C S52/ it a to be 
fanrroJIfd, tiered handled, pWSfTVtte^ distributed and deposed of tn accordance vuilh DHS policy relating to FQUQ information and is not (o he released to ihe pubk dw media, or other personnel wfw do not have a vabd 
need to know without pniy approval af an authorized OHS official Sidle arkf local hamefaud security officials may share tWi document wnh author u rd critical infrastructure and key resource personnel and private sector 
security affiant wfdxnrt further approval from DHS. 
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